In addition, as our method is closed to adversarial data augmentation, we also compares six adversarial data augmentation methods, including vi) MixUp [1]}, vii) CutMix [2]}, viii) Autoencoder [3]}, ix) AugGAN [4]}, x) MaxEntropy [5]}, and xi) MaxUp [6]}. According to Table REF , PGADA outperforms MixUp and CutMix by \(9.12\%\)  and \(8.84\%\)  on average. Compared with the Autoencoder and AugGAN, our method improved by \(11.77\%\)  and \(12.41\%\)  because they synthesize similar patterns to the original images to alleviate the data sparsity problem, which cannot create new information that is not included in the given data [6]}. In contrast, PGADA is able to explore the perturbed data that is most likely to confuse the model, which can be regarded as hard examples. Compared to MaxEntropy, which uses opposite gradients to search the worst data point, we observe that PGADA outperforms MaxEntropy by \(6.52\%\)  on average since PGADA adds noise to the generator, increasing the uncertainty of the generated data. Then, by adding these data points to the training phase, the model can defense against more unknown perturbations attacking, resulting in higher accuracy. In addition, our method also significantly outperforms MaxUp because the selected worst data point in MaxUp is still near the original images, resulting in less robustness. In addition, PGADA is more suitable for few-shot learning, as it generates the perturbations in a self-supervised manner by comparing the embedding of original images and perturbed images to explore hard examples.
<TABLE>